- Home
- Suite features
- Data Act cockpit
The EU Data Act, starting from the role you play
EU Data Act compliance starts with the role you play. The suite's Data Act cockpit records each unit in one of six roles — five from Art. 2 of Regulation (EU) 2023/2854, plus non-EU actor — and lists the obligation cards triggered, from access by design (Art. 3) to penalties (Art. 40). It maps duties; it does not test facts.
- Data Act · five Art. 2 roles + non-EU
- Art. 23, 25, 29, 30 · switching
- Art. 37(11) · non-EU flag
- Art. 7 size test · note only
- Art. 24, 26-28, 31 · no own card
Which EU Data Act requirements apply to a company outside the EU?
Those attached to the roles you hold, given an EU link. The Data Act reaches manufacturers of connected products placed on the EU market, providers of related services, data holders making data available to recipients in the Union and providers of data processing services to EU customers, wherever established (Art. 1(3)(a), (c), (f)). Having no EU office does not take a US company out; for in-scope companies it adds a duty: a legal representative in one of the Member States (Art. 37(11)).
One company is often several addressees. A connected product collects data on its use or environment and can communicate it, unless it mainly stores or processes data for others (Art. 2(5)); a related service is a digital service, such as a companion app, without which the product would lose a function, or one connected later to add to or adapt its functions (Art. 2(6)). A device maker is usually both manufacturer and data holder, possibly also a data-processing-service provider (Art. 2(8)).
Four steps to the obligation cards
Open /suite/#data-act. Both panels sit on one page; neither has its own address.
- Accept the legal notice. The "Legal Notice & Disclaimer" overlay, opening with "No Legal Advice", appears once.
- Work around the welcome screen. On a first visit its Data Act card (German label "Data Act · Datenzugang") does nothing. Choose "Cross-Regulation", then the database icon "Data-Act-Twin" in the left sidebar. Returning visitors land on the cockpit.
- Add actors. Under "Actor portfolio": a label, one role and, where they fit, the flags "Public-body request possible (B2G · Art. 14/15)" and "Established outside the EU (Art. 37(11) representative duty)". A unit with several roles is entered once per role. For a US unit, keep its real role and tick the non-EU flag: the role "Non-EU actor" alone triggers only Art. 37(11) and Art. 40.
- Read the obligations. "Data Act obligations" shows role chips, the Art. 7 and Art. 37(11) notes where they apply, and one card per duty: article, summary, tasks, cross-references.
What the cockpit maps for EU Data Act compliance
| Capability | Legal basis | Output |
|---|---|---|
| Actor roles | Art. 2(5), (6), (8), (13), (14); Art. 37(11) | Six roles, two flags, stored in your browser |
| Access and sharing | Art. 3-6 | Access by design; access and sharing on request; limits for data recipients |
| Conditions and terms | Art. 8-13 | Fair, reasonable and non-discriminatory (FRAND) terms, compensation, disputes, technical protection, unfair B2B terms |
| Public-sector requests | Art. 14-15 | Two cards, once a data holder is listed and any actor carries the B2G flag |
| Cloud switching | Art. 23, 25, 29, 30 | Four cards for data-processing-service providers |
| Governmental access, interoperability | Art. 32-36 | Five cards, by role |
| Representative, penalties | Art. 37(11), Art. 40 | Note and card once an actor is marked non-EU; penalties card for every role |
Export through the applicability statement
The cockpit has no export. Its 23 rows reappear in the obligation applicability statement under "Client Workflow" (HTML, CSV), marked applicable or not applicable from your roles: a self-assessment, not a legal finding. See deliverables and exports.
Data Act September 2026: which dates apply now?
Two have passed, two are ahead. The Regulation has applied since 12 September 2025. Data Act connected products and related services placed on the market after 12 September 2026 are to be designed so that their data are accessible to the user by default, easily and securely, and directly where relevant and technically feasible (Art. 3(1), Art. 50). Other regimes: EU regulatory deadlines.
- 12 September 2025Application (Art. 50): pre-contract information, access and sharing on request, switching, unfair-terms control for new contracts (Art. 13).
- 12 September 2026Access by design (Art. 3(1)) for newly marketed products and services.
- 12 January 2027Switching charges, egress for the switch included, may no longer be imposed (Art. 29(1), Art. 2(36)).
- 12 September 2027Chapter IV reaches older contracts of indefinite duration or expiring at least ten years after 11 January 2024 (Art. 50).
Amendments are pending. The Commission's Digital Omnibus proposal of 19 November 2025 would, among other things, limit public-sector requests to public emergencies, ease switching duties for custom-made services and smaller providers on contracts concluded by 12 September 2025, and repeal Art. 36 on smart contracts. Still under negotiation at our last review; the cockpit maps the text in force.
A hypothetical US device maker, actor by actor
Take a hypothetical Ohio maker of connected air compressors sold to factories in Germany and Poland, with a fleet-monitoring app and no EU establishment. It enters "Compressor line" as connected-product manufacturer with the non-EU flag, "Fleet app" as related-service provider and "Telemetry store" as data holder.
The panel shows the Art. 7 note, the Art. 37(11) warning and thirteen cards: Art. 3, 4, 5, 8 to 13, 33, 36, 37(11) and 40. Thirteen cards are not thirteen duties: Art. 33 addresses participants in data spaces, Art. 36 vendors of smart-contract applications and those deploying smart contracts for others, and Chapter III presupposes a legal duty to make data available (Art. 12(1)).
A fourth actor, "Analytics cloud", a hosted service for customers' plant data, entered as data-processing-service provider, adds Art. 23, 25, 29, 30, 32, 34 and 35: twenty cards, Data Act cloud switching included (the cloud and hosting sector profile sets that chapter beside NIS2).
What the Data Act cockpit leaves to you
- The role is your selection; nothing tests it against Art. 2(5), (6) or (8).
- Cards fire on role alone and are pooled across actors: a B2G flag on any actor counts for every data holder.
- No size logic: any role puts the portfolio in scope, and the Art. 7 carve-out for micro and small enterprises is a note.
- The user (Art. 2(12)) is not a role: a buyer of connected products sees no view of its own rights.
- Art. 24, 26 to 28 and 31 have no card, including the Art. 28 transparency on international access.
- No legal-map nodes or cross-regulation edges for the Data Act; the cards' cross-references (GDPR, DMA, AI Act, PIPL) are plain text.
- Actors can be removed, not edited; they sit in local browser storage, tied to no account; see the Trust Center.
Frequently asked questions
What is the EU Data Act and when does it apply?
The EU Data Act, Regulation (EU) 2023/2854, has applied since 12 September 2025 (Art. 50). It governs access to data from connected products and related services, the terms for making data available, unfair B2B data terms, public-sector requests in exceptional need and switching between data processing services (Chapters II to VI).
Who is the data holder under the Data Act?
A natural or legal person with the right or obligation, under the Data Act, other Union law or national legislation adopted in accordance with Union law, to use and make available data, including, where contractually agreed, product or related-service data it has retrieved or generated while providing a related service (Art. 2(13)). In the cockpit, Data Act data holder obligations come to 12 cards, 14 with a B2G flag.
Does the Data Act's cloud switching chapter apply to SaaS providers?
Yes, where the offering is a data processing service (Art. 2(8)); Recital 81 names software as a service among the delivery models. Art. 31(1) lifts Art. 23(d), Art. 29 and Art. 30(1) and (3) for custom-built services not offered at broad commercial scale; Art. 31(2) exempts time-limited test versions from the whole chapter. See the B2B SaaS sector profile.
When do switching and egress charges have to go?
From 12 January 2027, providers of data processing services may not impose switching charges (Art. 29(1)); these include data egress charges for the switch but not standard service fees or early-termination penalties (Art. 2(36)). Until then, reduced charges may not exceed the costs directly linked to the switch (Art. 29(2)-(3)). For services used in parallel, egress charges stay capped at cost (Art. 34(2)).
How does the Data Act interact with the GDPR?
The GDPR prevails: the Data Act is without prejudice to data protection law, which takes precedence in a conflict (Art. 1(5)). Where product data is personal data, access and sharing under Art. 4 and Art. 5 need a GDPR legal basis. Seam 06 of the cross-regulation collision map maps that boundary.
Do non-EU companies need a representative under the Data Act?
Yes, if they are in scope, make connected products available or offer services in the Union and are not established there: Art. 37(11) requires a legal representative in one of the Member States. The cockpit flags this once any actor is marked non-EU. Regingada UG (haftungsbeschränkt) provides this service; see the Data Act representative page.
A role picked is not a role established
The cockpit indicates duties; it does not act for you in the Union. Where you are in scope but have no EU establishment, your EU representative under Article 37(11) can be Regingada UG (haftungsbeschränkt): the authorities' point of contact, not the one who decides your duties.
EU Data Act compliance turns on classifications made before you pick a role: connected product or not, related service or data processing service, who holds the data under your contracts, what Art. 4 and Art. 5 let you withhold as a trade secret. Those belong with the law firm Theo Funk, under a separate mandate; the cards and the statement are drafts to bring along.